我正在尝试使用 OpenVPN 通过安全连接访问互联网。
我已在 Amazon EC2 上配置并运行 openVPN，使用客户端证书以桥接模式运行。我可以从客户端成功连接，但无法访问互联网或从客户端 ping 任何内容
我检查了以下内容，一切似乎都表明 vpn 客户端/服务器与 1194 上的 UDP 流量之间的连接成功
[server] sudo tcpdump -i eth0 udp port 1194
(shows UDP traffic after establishing connection)
[server] sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[server] sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- ip-W-X-Y-0.us-west-1.compute.internal/24 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[server] openvpn.log
Wed Oct 19 03:11:26 2011 localhost/a.b.c.d:61905 [localhost] Inactivity timeout (--ping-restart), restarting
Wed Oct 19 03:11:26 2011 localhost/a.b.c.d:61905 SIGUSR1[soft,ping-restart] received, client-instance restarting
Wed Oct 19 03:41:31 2011 MULTI: multi_create_instance called
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Re-using SSL/TLS context
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 LZO compression initialized
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Local Options hash (VER=V4): '360696c5'
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 Expected Remote Options hash (VER=V4): '13a273ba'
Wed Oct 19 03:41:31 2011 a.b.c.d:57889 TLS: Initial packet from [AF_INET]a.b.c.d:57889, sid=dd886604 ab6ebb38
Wed Oct 19 03:41:35 2011 a.b.c.d:57889 VERIFY OK: depth=1, /C=US/ST=CA/L=SanFrancisco/O=EXAMPLE/CN=EXAMPLE_CA/[email protected]
Wed Oct 19 03:41:35 2011 a.b.c.d:57889 VERIFY OK: depth=0, /C=US/ST=CA/L=SanFrancisco/O=EXAMPLE/CN=localhost/[email protected]
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Oct 19 03:41:37 2011 a.b.c.d:57889 [localhost] Peer Connection Initiated with [AF_INET]a.b.c.d:57889
Wed Oct 19 03:41:39 2011 localhost/a.b.c.d:57889 PUSH: Received control message: 'PUSH_REQUEST'
Wed Oct 19 03:41:39 2011 localhost/a.b.c.d:57889 SENT CONTROL [localhost]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route-gateway W.X.Y.Z,ping 10,ping-restart 120,ifconfig W.X.Y.Z 255.255.255.0' (status=1)
Wed Oct 19 03:41:40 2011 localhost/a.b.c.d:57889 MULTI: Learn: (IPV6) -> localhost/a.b.c.d:57889
[client] tracert google.com
Tracing route to google.com [74.125.71.104] over a maximum of 30 hops:
1 347 ms 349 ms 348 ms PC [w.X.Y.Z]
2 * * * Request timed out.
我还可以从客户端成功 ping 服务器 IP 地址，并从服务器上的 SSH shell ping google.com。我做错了什么？
这是我的配置（注意：WXYZ == amazon EC2 私有 IP 地址）
br0 上的桥接配置
ifconfig eth0 0.0.0.0 promisc up
brctl addbr br0
brctl addif br0 eth0
ifconfig br0 W.X.Y.X netmask 255.255.255.0 broadcast W.X.Y.255 up
route add default gw W.X.Y.1 br0
/etc/openvpn/server.conf（来自https://help.ubuntu.com/10.04/serverguide/C/openvpn.html）
local W.X.Y.Z
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
;server W.X.Y.0 255.255.255.0
server-bridge W.X.Y.Z 255.255.255.0 W.X.Y.105 W.X.Y.200
;push "route W.X.Y.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
tls-auth ta.key 0 # This file is secret
user nobody
group nogroup
log-append openvpn.log
iptables 配置
sudo iptables -A INPUT -i tap0 -j ACCEPT
sudo iptables -A INPUT -i br0 -j ACCEPT
sudo iptables -A FORWARD -i br0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s W.X.Y.0/24 -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
已添加路由表
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
W.X.Y.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
0.0.0.0 W.X.Y.1 0.0.0.0 UG 0 0 0 br0
C:>route print
===========================================================================
Interface List
32...00 ff ac d6 f7 04 ......TAP-Win32 Adapter V9
15...00 14 d1 e9 57 49 ......Microsoft Virtual WiFi Miniport Adapter #2
14...00 14 d1 e9 57 49 ......Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Net
work Adapter
10...00 1f d0 50 1b ca ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
11...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
36...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.1.2.1 10.1.2.201 25
10.1.2.0 255.255.255.0 On-link 10.1.2.201 281
10.1.2.201 255.255.255.255 On-link 10.1.2.201 281
10.1.2.255 255.255.255.255 On-link 10.1.2.201 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.1.2.201 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.1.2.201 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.1.2.1 Default
===========================================================================
C:>tracert google.com
Tracing route to google.com [74.125.71.147]
over a maximum of 30 hops:
1 344 ms 345 ms 343 ms PC [W.X.Y.221]
2 * * * Request timed out.
答案1
我认为错误出在桥接定义上。桥接必须由 eth0-device 和 tap0-device 组成。
就我的例子来说，是这样的：
brctl show br0
bridge name bridge id STP enabled interfaces
br0 8000.000c29af7f50 no tap1
eth2
Bridge-device 中有 IP 10.1.2.1（来自您的示例）和 iptables（在您的示例中，FORWARD-chain 默认为 ACCEPT）：
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.1.2.0/24 anywhere
因此，客户端 10.1.2.201 将在 OpenVPN 服务器上执行 MASQUERADE 操作。
openvpn-server 的配置必须有（例如）：
server-bridge 10.1.2.1 255.255.255.0 10.1.2.2 10.1.2.200